{"id":"CVE-2026-107276","revision":"3cf180614ecc4101a3df1f159a1366b8","records":[{"revision":"3cf180614ecc4101a3df1f159a1366b8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107276","aliases":[],"title":"MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests","description":"MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect.\n\nPreconditions:\n\n- The target MISP instance has email OTP login enabled.\n\n- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).\n\n- The attacker can issue two HTTP POST requests in close temporal proximity.\n\nImpact:\n\n- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.\n\n- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.\n\nAffected versions: <2.5.48","state":0,"publishedAt":"2026-10-07T15:36:49.564+00:00","modifiedAt":"2026-10-07T20:28:21.466+00:00","affected":[{"ecosystem":"Vendor product","name":"MISP","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"cpes\": [\n                        \"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"modules\": [\n                        \"UsersController (email OTP login)\"\n                    ],\n                    \"product\": \"MISP\",\n                    \"programFiles\": [\n                        \"app/Controller/UsersController.php\"\n                    ],\n                    \"repo\": \"https://github.com/MISP/MISP\",\n                    \"vendor\": \"MISP\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"2.5.48\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","score":6.3,"severity":"MEDIUM"}],"references":["https://github.com/MISP/MISP/commit/ba95e67d5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107276","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107276","identifiers":["CVE-2026-107276"]},"retained":false,"historicalAffected":[]}],"coverage":[]}